Jenkins Vulnerability Allows Access to Other Users' Views Without Permission
CVE-2024-43045

6.3MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins
Vendor
CVE Published:
7 August 2024

Summary

A security vulnerability in certain versions of Jenkins arises from the absence of a proper permission check within an HTTP endpoint. This flaw permits users with Overall/Read permissions to access other users' personal 'My Views'. As a consequence, sensitive user configurations could be exposed, which poses a risk to user privacy and system integrity. This issue affects all versions of Jenkins up to and including 2.470, as well as the Long-Term Support (LTS) version 2.452.3 and earlier. It is essential for users to review their Jenkins installations and ensure that they apply the necessary updates to remediate this vulnerability.

Affected Version(s)

Jenkins 2.452.4

Jenkins 2.452.4 < 2.452.*

Jenkins 2.462.1 < 2.462.*

References

https://www.jenkins.io/security/advisory/2024-08-07/#SECU...
vendor-advisory

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.